T5142: Add audit tool to monitor security-relevant events

[sever-sever]

Change Summary

One of the requirements of a Collaborative Protection Profile cPP for Network Devices is using a system auditing tool to monitor and log all security-relevant events.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related PR's

• T5142: systemd-journald-audit must not show logs from auditd vyos-build#333

Related Task(s)

• https://vyos.dev/T5142
• https://vyos.dev/T4712

Component(s) name

audit, log

Proposed changes

How to test

vyos@r14:~$ show log audit | tail -n 5
type=USER_LOGIN msg=audit(1680605305.274:946): pid=3991 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct="foo" exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=sshd res=failed'UID="root" AUID="unset"
type=USER_AUTH msg=audit(1680605306.452:947): pid=3991 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=? acct="foo" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=failed'UID="root" AUID="unset"
type=USER_LOGIN msg=audit(1680605308.416:948): pid=3991 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct="foo" exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=sshd res=failed'UID="root" AUID="unset"
type=USER_AUTH msg=audit(1680605309.691:949): pid=3991 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=? acct="foo" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=failed'UID="root" AUID="unset"
type=USER_LOGIN msg=audit(1680605312.068:950): pid=3991 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct="foo" exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=sshd res=failed'UID="root" AUID="unset"
vyos@r14:~$ 

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly